As reported by The Hacker News, the Spanish-speaking threat actor Blind Eagle (APT-C-36) has launched a new campaign targeting Latin American organizations using judicial-themed phishing lures to deliver a custom RAT with AsyncRAT and DCRat lineage. While the group has been active since 2018, this latest iteration demonstrates notable evolution in evasion tradecraft that warrants closer examination.

Threat Intelligence: As reported by The Hacker News, the Spanish-speaking threat actor Blind Eagle (APT-C-36) has launched a new campaign targeting Latin American organizations using judicial-themed phishing lures to deliver a custom RAT with AsyncRAT and DCRat lineage.

Why This Campaign Stands Out

Several technical elements elevate this campaign above standard commodity RAT distribution:

Why This Campaign Stands Out
HTML smuggling via weaponized SVG: The XHTML file containing a malicious SVG image assembles the ZIP payload locally in the browser using ZipCrypto, effectively bypassing email gateway and network-level content inspection. This is a relatively sophisticated delivery mechanism for a group historically associated with commodity malware.
AMSI and ETW bypass at the script layer: The VBScript dropper actively disables Windows Antimalware Scan Interface and Event Tracing for Windows before payload execution, blinding both signature-based and behavioral detection controls.
MotW stripping and artifact cleanup: Removing Mark of the Web metadata neutralizes SmartScreen protections, while deleting the original XHTML artifact hinders forensic investigation.
Fileless final stage: The RAT payload is decoded and injected directly into memory via PowerShell, leaving minimal disk artifacts.

Who Is at Risk

The targeting profile — individuals handling cases, contracts, judicial proceedings, and institutional service requests — points to exposure across several sectors:

  • Government judicial bodies and attorney general offices, particularly in Colombia and Brazil
  • Legal departments within private organizations operating in Latin America
  • Educational institutions processing administrative or legal documentation
  • Financial organizations handling compliance or regulatory correspondence
Any organization with Portuguese or Spanish-language operations in the region should consider itself potentially in scope, as the lures are tailored to mimic legitimate fiscalía notices, tutela proceedings, and administrative documents.

The AsyncRAT/DCRat Lineage Problem

Commodity RAT forks persist because they work. Each iteration adds incremental evasion improvements while retaining the familiar remote access functionality that makes them effective for data theft and initial access brokering.

Blind Eagle's consistent use of RAT families in the AsyncRAT, NjRAT, Quasar, and Remcos ecosystem reflects a deliberate operational choice: these tools provide reliable C2 capabilities, keylogging, screen capture, and file exfiltration without requiring custom development. The fork described in this campaign retains structural and behavioral similarities to its predecessors, which is an advantage for defenders — existing detection logic for AsyncRAT variants may partially apply, though the AMSI/ETW bypasses and fileless execution require dedicated detection coverage.

Shield53 Recommendations

Email Security Controls

  • Block or quarantine XHTML and SVG attachments from external senders, particularly those impersonating government domains
  • Deploy or tune HTML smuggling detection rules — look for JavaScript Blob construction and ZipCrypto patterns within SVG/XHTML content
  • Implement DMARC enforcement (p=reject) and flag emails spoofing judicial or fiscalía sender domains

Endpoint Detection and Response

  • Monitor for VBScript execution originating from ZIP archives extracted via browser — correlate with JavaScript child processes
  • Deploy detection rules for AMSI patching and ETW provider disablement at the script level, including reflective in-memory patching of amsi.dll
  • Alert on PowerShell executing encoded payloads (-EncodedCommand, -e, Base64 decode patterns) from the Windows Startup folder or from user-profile temporary directories
  • Monitor for MotW removal operations, particularly Set-Content or Remove-Item targeting Zone.Identifier alternate data streams

User Awareness

  • Brief staff in legal, compliance, and administrative roles on this specific campaign — judicial-themed phishing is highly convincing to personnel who regularly handle court documents
  • Establish out-of-band verification procedures for any court or fiscalía notice received via email, especially those requiring document download

Network Defense

  • Block known AsyncRAT and DCRat C2 infrastructure at the network perimeter and inspect DNS for dynamic DNS domains commonly used by these families
  • Enable TLS inspection for egress traffic where regulatory context permits, as RAT variants in this lineage frequently use encrypted C2 channels

Broader Implications

Blind Eagle's continued activity across Latin America underscores a persistent regional threat that has not received the visibility it merits relative to its operational tempo. The group's ability to consistently refine evasion techniques while leveraging commodity malware suggests either a well-resourced operation or access to a mature malware-as-a-service ecosystem. Organizations operating in or with business relationships in Colombia, Brazil, and neighboring countries should treat judicial-themed phishing as an active, high-probability threat rather than a hypothetical scenario.